Dutch regulator fines Uber $966m for automating driver suspensions

Algorithmic Deactivations Cost Uber €825m in Landmark Dutch GDPR Penalty

Wanderstayfinder.com – A European data-protection authority has levied one of the largest fines ever under the continent’s privacy framework against a ride-hailing giant, ruling that the company’s use of automated systems to shut down driver accounts violated fundamental rights of workers who depend on those accounts for their livelihood. The Dutch Data Protection Authority announced the €825m ($966m) sanction on 17 August, making it the second-biggest GDPR penalty ever imposed. Only Meta’s €1.2bn ($1.4bn) fine, handed down by Ireland in 2023 over cross-border Facebook data transfers, exceeds it. Meta is contesting that earlier ruling; Uber has said it will do the same.

What the regulator found

The investigation covered European incidents spanning 2018 through 2022. At its core, the case concerned Uber’s practice of deactivating driver accounts through algorithmic systems without providing adequate notice or meaningful human oversight before action was taken.

The agency identified two categories of affected drivers. First, those temporarily suspended because automated systems flagged suspected fraud — such as unnecessary detours designed to inflate fares, or trips accepted with no intention of completion. Uber maintained these suspensions were typically short-lived and that permanent deactivations always involved human review before finalisation.

Second, and more critically, drivers whose customer ratings fell below a threshold were sometimes permanently deactivated by computer alone. The Dutch authority treated this as a clear breach of data-subject rights. Uber contested the characterisation, insisting it had never automated permanent deactivation decisions.

The regulator’s reasoning

Monique Verdier, deputy chair of the Dutch authority, confirmed the decision in a public statement later on Friday.

“Uber has committed serious infringements” by deactivating driver accounts without warning or human involvement, Verdier said. “From one moment to the next they no longer had any income … A computer should not make decisions on its own that have (such) major consequences.”

The fine was calculated as a fraction of Uber’s 2025 annual turnover, a standard mechanism under GDPR that scales penalties to a company’s financial capacity rather than applying a fixed ceiling.

Uber’s response

The company announced it would appeal the ruling.

“We strongly disagree with this decision and disproportionate fine,” a spokesperson said, adding that the company takes drivers’ rights seriously and its policies include both human reviews and opportunities for drivers to dispute platform suspensions.

Uber argued the penalty was outsized because only a small number of drivers were ultimately affected. The company cited a figure of 126 drivers deactivated across Europe in 2021 as a result of low customer ratings, contending that the scale of impact did not justify a fine of this magnitude.

How the case began

The investigation traces back to a complaint originally filed in France. Because Uber’s European headquarters are located in Amsterdam, the Dutch authority assumed jurisdiction under GDPR’s one-stop-shop mechanism, which designates a single lead regulator for cross-border cases to avoid parallel proceedings in multiple member states.

Swiss digital-rights organisation PersonalData.IO played a catalytic role in bringing the matter to light. The group assisted French Uber drivers in requesting data about the algorithmic decisions affecting their work — a right enshrined in GDPR’s access provisions. That data request ultimately surfaced the patterns that triggered the Dutch investigation.

Paul-Olivier Dehaye, founder of PersonalData.IO, said the organisation was pleased with the outcome and is preparing a class-action suit against Uber seeking compensation for affected drivers.

The GDPR rule at issue

Article 22 of the GDPR prohibits decisions that produce legal or similarly significant effects on individuals when made solely by automated means. Employment decisions — including the loss of a means of earning income — fall squarely within this prohibition. The regulation requires that such decisions incorporate meaningful human review and provide a channel for the affected person to contest the outcome before it takes effect.

The ruling thus reinforces a principle regulators have been emphasising since the regulation took effect in 2018: that algorithmic efficiency cannot override the right of workers to know why their livelihood has been interrupted and to have a human being evaluate that decision before it becomes irreversible.

A wider regulatory pattern

The Uber penalty sits within a broader wave of multibillion-euro sanctions imposed on large US technology firms under privacy, competition, and digital-market rules. Last month, the European Commission fined Google €890m ($1.04bn) for anti-competitive conduct. Meta, Google, Apple, and Amazon each face multiple outstanding fines, though headline amounts are frequently reduced or reversed after years-long appeals processes.

US President Donald Trump has publicly criticised such penalties. In April, a State Department official described them as the “biggest single source of friction” in US-EU economic relations, underscoring how data-protection enforcement has become a flashpoint in transatlantic trade diplomacy.

For gig-economy workers across Europe, the decision carries practical weight beyond the headline number. It signals that regulators will scrutinise not only how platforms collect and store personal data, but how they deploy algorithms to make consequential decisions about workers’ access to income — decisions